Time picker seems to be overriding earliest=-24, any suggestions?

[splunkzilla]

Hello all!  Newbie here so please forgive the ignorance in advance!

I have a search:

index="zscaler" reason="Reputation block outbound request: malicious URL"
|dedup _time
|stats count as siteCount by url,user
|where siteCount > 3
|search earliest=-24h

When running this search in the search bar, the time picker is overriding the 24 hour search criteria, which from what I read in the documentation shouldn't occur (unless it's a subsearch).  I'm using this for alerting purposes so I want to be sure to specify the time frame I'd like to search.  Any suggestions? 

[richgalloway · Accepted solution]

The earliest keyword overrides the time picker only if it is before the first pipe (|).

The command search earlies=-24h makes no sense in this query because there is no _time field to check.  The stats command discarded all but the siteCount, url, and user fields.  What is the goal of that command?

[splunkzilla]

Once I moved the "earliest" command to the beginning of the query, it worked perfectly.  Thank you!

[splunkzilla]

Ah, good to know about the earliest command, thank you!

The overall goal is to find more than 3 outbound connections to a known bad URL within a 24 hour period.  We had an issue where there were multiple connection attempts from a single user that had identical timestamps. That's the reason for the dedup portion of the query. 

For the "earliest=-24" portion of the query, we had issues where there the alert showed connection attempts over hours and/or days, so I wanted to set a time constraint.